Both devices seem to be completely identical and D-Link doesnt even
mention the DIR-X1550 A1 in the GPL source. Furthermore the supported
devices header also just contains DIR-X1860 B1. The cherry on top is the
FCC filing, which features the manual for DIR-X1550 A1 but the label
info for DIR-X1860 B1. I guess someone at D-Link was just as confused as
me.
Hardware
--------
SOC: MediaTek MT7621AT
FLASH: 128MB (Spansion S34ML01G200TF100)
RAM: 256MB (Winbond W632GU6NB-12)
WIFI: MediaTek MT7915DAN + MT7975DN DBDC 2x2 802.11ax
ETH: 1x WAN, 3x LAN
LED: 6 (4 GPIO controllable, 2 WIFI hardwired)
BTN: WPS, Reset
UART: 115200 8N1 (Pinout silkscreened) - ignore VCC
MAC addresses
-------------
LAN Label MAC (stored in config2 partition as ASCII (entry
factory_mac=xx:xx:xx:xx:xx:xx))
WAN LAN + 3
2.4G LAN + 1
5G LAN + 2
Installation
------------
Vendor UI
---------
1. Browse to http://192.168.0.1 and login.
2. Navigate to "Management" -> "Upgrade".
3. Press the "Select File" button and upload
openwrt-ramips-mt7621-dlink_dir-x1860-b1-squashfs-factory.bin
4. Confirm the security questions, wait for a reboot and enjoy OpenWrt.
Recovery UI
-----------
1. Set your IP address to 192.168.0.101, subnet 255.255.255.0.
2. Power on the device while holding reset.
3. Release reset once the status led starts to blink orange.
4. Open a chrome- or firefox based browser and browse to
https://192.168.0.1
5. Upload openwrt-ramips-mt7621-dlink_dir-x1860-b1-squashfs-recovery.bin
wait for a reboot and enjoy OpenWrt.
Back to stock
-------------
1. Set your IP address to 192.168.0.101, subnet 255.255.255.0.
2. Power on the device while holding reset.
3. Release reset once the status led starts to blink orange.
4. Open a chrome- or firefox based browser and browse to
https://192.168.0.1
5. Upload a decrypted vendor image, wait for a reboot and regret your
decision.
Decrypt vendor image
--------------------
1. Download dlink-sge-image.c and dlink-sge-image.h from the
firmware-utils openwrt repository.
2. Compile a binary from the downloaded file
e.g. gcc dlink-sge-image.c -lcrypto -o dlink-sge-image
3. Run
./dlink-sge-image DIR-X1860-B1 <vendor_image> <decrypted_image> -d
Signed-off-by: Christoph Krapp <achterin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20410
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This patch adds support for Cudy C200P.
Specifications:
SoC: MediaTek MT7621AT
RAM: 256 MB (DDR3)
Flash: 16 MB (NOR)
POE Chip: IP804AR
Interfaces:
Switch: 1 WAN, 4 LAN (Gigabit)
Gigabit RJ45 PoE Ports on 2~5
Max Power on a Single PoE Ports 30W
PoE Ports : The PoE ports comply with IEEE 802.3at/af standards.
Ports: 1 USB-A 3.0 Ports
LED:
System
PoE Max Status
Link/ACT/PoE Status of Each PoE Port
Physical Buttons:
Reset Button
Power Input:
DC Jack
Power Methods:
DC: 54V 1.11A
802.3at/af PoE
Passive PoE: 24/48V
Max Power Consumption (W):
Total: 60W
PoE: 55W
PoE (when USB Device is plugged in): 50W
No PoE: 5W
Installation:
To install OpenWRT, you need the intermediate firmware from Cudy. (U-boot is locked). After installing the intermediate firmware, you can install OpenWRT via sysupgrade.
Recovery:
TFTP available.
1. Place the recovery.bin in the serving directory of your TFTP server.
2. Set your IP to 192.168.1.88/24.
3. Press the “Reset” button of Cudy router and hold it. Before the Cudy router is powered on and before TFTP start to download the firmware, don't release the “Reset” button.
4. Power on the Cudy router.
5. You can release the reset button only when TFTP starts downloading firmware.
6. When the SYSTEM LED turns solid green, the upgrade is complete.
Serial:
1. Serial connection parameters: 115200 / 8N1
2. Serial connection voltage: 3.3V
PoE is not supported at the time of PR. The IP804R chip is not yet supported by OpenWRT.
Signed-off-by: Marcin Leksmark <lexmark3200@wp.pl>
Link: https://github.com/openwrt/openwrt/pull/20165
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Plasma Cloud PAX1800-Lite is a dual-band Wi-Fi 6 router, based on MediaTek
MT7621A + MT79x5D platform.
Specifications:
- SOC: MT7621AT (880 MHz)
- DRAM: DDR3 448 MiB (Nanya NT5CC256M16DP-DI)
- Flash: 2 MiB SPI NOR (S25FL016K) + 128 MB SPI NAND (W25N02KVZEIR)
- Ethernet: 1x 10/100/1000 Mbps (SOC's built-in switch, with PoE+)
- Wi-Fi: 2x2:2 2.4/5 GHz (MT7905DAN + MT7975DN)
(MT7905DAN doesn't support background DFS scan/BT)
- LED: tri-color LED for status (red, blue, green)
- Buttons: 1x (reset)
- Antenna: 4x internal, non-detachable omnidirectional
- UART: 1x 4-pin (2.54 mm pitch, marked as "3V3 G/RX GND W/TX")
- Power: 12 V DC/2 A (DC jack)
MAC addresses:
WAN: 54:9C:27:xx:xx:00 (factory 0x3fff4, device label)
2.4 GHz: 54:9C:27:xx:xx:02 (factory 0x4, device label +2)
5 GHz: 54:9C:27:xx:xx:08 (factory 0xa, device label +8)
Flashing instructions:
======================
Various methods can be used to install the actual image on the flash.
Two easy ones are:
ap51-flash
----------
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the image to the u-boot when the device boots up.
initramfs from TFTP
-------------------
The serial console (115200 8N1) must be used to access the u-boot shell
during bootup. It can then be used to first boot up the initramfs image
from a TFTP server (here with the IP 192.168.1.21):
setenv serverip 192.168.1.21
setenv ipaddr 192.168.1.1
tftpboot 0x83001000 <filename-of-initramfs-kernel>.bin && bootm $fileaddr
The actual sysupgrade image can then be transferred (on the LAN port) to the
device via
scp <filename-of-squashfs-sysupgrade>.bin root@192.168.1.1:/tmp/
On the device, the sysupgrade must then be started using
sysupgrade -n /tmp/<filename-of-squashfs-sysupgrade>.bin
Signed-off-by: Sven Eckelmann (Plasma Cloud) <se@simonwunderlich.de>
Link: https://github.com/openwrt/openwrt/pull/20152
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SIM SIMAX1800U has the similar hardware design as the SIMAX1800T. The
only difference is the Ethernet portmap.
Specification
-------------
- SoC : Mediatek MT7621
- RAM : 256 MiB DDR3
- Flash : 128 MiB NAND Flash
- WLAN : Mediatek MT7905 DBDC
- 2.4 GHz : 2x2 MIMO WiFi6
- 5 GHz : 2x2 MIMO WiFi6
- Ethernet : MT7621 built-in 10/100/1000 Mbps 1x WAN; 3x LAN
- UART : 3.3V, 115200n8
- Buttons : 1x RESET; 1x WPS/MESH
- LEDs : 1x Multi-Color(Blue;Green;Red)
- Power : DC 12V1A
- CMIIT ID : 2022AP7163
- TFTP IP :
- server : 192.168.1.254
- router : 192.168.1.28
TFTP Installation(recommend)
------------
1. Set local tftp server IP "192.168.1.254" and NetMask "255.255.255.0".
2. Rename initramfs-kernel.bin to "factory.bin" and put it in the root
directory of the tftp server. tftpd64 is a good choice for Windows.
3. Remove all Ethernet cables and WiFi connections from the PC, except
for the one connected to the SIMAX1800U. Start the TFTP server, plug
in the power adapter and wait for the OpenWrt system to boot.
4. Backup "firmware" partition and rename it to "firmware.bin". We need
it to back to the stock firmware.
5. Use "fw_printenv" command to list envs. If "firmware_select=2" is
observed then set u-boot env variable via command:
`fw_setenv firmware_select 1`
6. Apply sysupgrade.bin in OpenWrt LuCI.
Web UI Installation
------------
1. Apply update by uploading initramfs-factory.bin to the web UI.
2. Use "fw_printenv" command to list envs. If "firmware_select=2" is
observed then set u-boot env variable via command:
`fw_setenv firmware_select 1`
3. Apply squashfs-sysupgrade.bin in OpenWrt LuCI.
Return to Stock Firmware
----------------------------
Restore the backup firmware partition in the installation step 4.
MAC addresses
-------------
+---------+-------------------+
| | MAC example |
+---------+-------------------+
| LABEL | 98:xx:xx:xx:xx:b2 |
| LAN | 98:xx:xx:xx:xx:b5 |
| WAN | 98:xx:xx:xx:xx:b2 |
| WLAN2G | 98:xx:xx:xx:xx:b4 |
| WLAN5G | 9a:xx:xx:xx:xx:b4 |
+---------+-------------------+
Tips:
-----------
User can use `TFTP Installation` method to recover a brick device.
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/19455
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
JDCloud RE-SP-01B is a dual-band WiFi 5 router based on the MT7621AT.
Specifications:
- SoC: MediaTek MT7621AT
- RAM: 512MB DDR3
- Flash: 32MB SPI NOR
- WiFi: MediaTek MT7603EN (2.4GHz), MediaTek MT7615N (5GHz)
- Ethernet: 1x WAN, 2x LAN (Gigabit Ethernet)
- LEDs: red, blue, green (GPIO controlled)
- Button: Reset (GPIO controlled)
- eMMC: Single onboard (32GB/64GB/128GB)
- USB: 1x USB 2.0 port
MAC Address Structure:
The MAC addresses share the structure DC:D8:7C:XX:XX:XX, where:
- WAN, LAN, and 2.4GHz WiFi: same as the label MAC address.
- 5GHz WiFi: label MAC address + 0x800000.
The manufacturer writes the label MAC address at different
offsets depending on the storage version of the device:
e.g.
128GB version: &config + 0x442a
64GB version: &config + 0x4429
So `get_mac_ascii()` is used here to search for the
base label MAC address of the device.
Ref:
https://github.com/openwrt/openwrt/pull/17409#discussion_r1899674262https://github.com/immortalwrt/immortalwrt/commit/c0c480d
Flash Instruction:
A 3rd party bootloader is required to boot the image. You can
use a SOP16 test clip to burn the image/bootloader to the flash.
The official bootloader does provide a web recovery interface
which only accepts an official image. To access it, you will
need to hold the reset button and power on the device, set your
IP address to 192.168.68.2 and visit http://192.168.68.1.
Co-authored-by: Chukun Pan <amadeus@jmu.edu.cn>
Signed-off-by: Yijie Jin <jinyijie@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/17409
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
For all HiWiFi series devices, the base MAC address is stored on
"bdinfo" partition, offset 0x18a, ASCII text format. The recently
introduced "mac-base" nvmem layout can handle the ASCII text now,
so it's time to move MAC address configurations to dts. There is
no valid MAC info in the "factory" partition, hence they will be
replaced with the correct ones.
Tested on HiWiFi HC5661A and HC5861.
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/18251
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The Arcadyan WE410443 is a WiFi AC access point distributed by various ISPs
under various names, including KPN SuperWifi and BT Whole Home Wi-Fi. It
features one ethernet port, dual MT7615N radios and four internal antennas.
Hardware:
- SoC: Mediatek MT7621AT
- Flash: 32 MB
- RAM: 128 MB
- Ethernet: 1x 10/100/1000 Mbps, built into the SoC
- WLAN: 2x MediaTek MT7615N
- Buttons: 1 Reset button, 1 WPS button
- LEDs: 1x Green, 1x Blue, 1x Red, all unmarked
- Power: 12 VDC, 1.5A barrel plug
Installation:
The bootloader is locked with a password, so the image needs to be written
directly to the SPI flash chip. To do this, you need to open up the case,
remove the heatsink and connect the flash chip to a Raspberry Pi. Use the
following connections:
Flash chip --> Raspberry Pi
VCC --> 3v3
RESET --> 3v3
/CS --> GPIO 8
DO --> GPIO 9
CLK --> GPIO 11
DI --> GPIO 10
GND --> Ground
You can solder wires to the flash chip, or use a SOIC16 clip. More details on
the Raspberry Pi and SPI chip pinouts are available on the wiki [1]
When you have the Raspberry Pi connected to the flash chip, boot your Pi and
follow the instructions:
1) Make sure your Pi has SPI enabled with sudo raspi-config
2) Install necessary tools: sudo apt install xxd libubootenv-tool mtd-utils
3) Upload overlay and execute:
sudo dtc -@ -I dts -O dtb -o
/boot/overlays/we410443.dtbo we410443-overlay.dts
4) Enable in /boot/firmware/config.txt by adding a new line containing
dtoverlay=we410443
5) Reboot your Pi and verify the mtd partitions with
cat /proc/mtd, you should see:
dev: size erasesize name
mtd0: 02000000 00001000 "all"
mtd1: 00030000 00001000 "u-boot"
mtd2: 00010000 00001000 "u-boot-env"
mtd3: 00010000 00001000 "factory"
mtd4: 01f60000 00001000 "firmware"
mtd5: 00010000 00001000 "glbcfg"
mtd6: 00010000 00001000 "config"
mtd7: 00010000 00001000 "glbcfg2"
mtd8: 00010000 00001000 "config2"
6) Optionally (but recommended), make a backup:
sudo dd if=/dev/mtd0 of=backup.bin
It can be restored with: sudo flashcp backup.bin /dev/mtd0
7) Set the variables for the bootloader:
echo '/dev/mtd2 0x0 0x1000 0x1000' > fw_env.config
sudo fw_setenv -c fw_env.config bootpartition 0
8) Finally, flash the image:
sudo flashcp openwrt-ramips-mt7621-arcadyan_we410443-
squashfs-sysupgrade.bin /dev/mtd4
MAC addresses
The label address is stored in ASCII in the config partition
Use --> Address
Device --> label
Ethernet --> label
WLAN 2g --> + 1
WLAN 5g --> + 2
References:
[1] https://openwrt.org/toh/arcadyan/astoria/we410443
Signed-off-by: Sander van Deijck <sander@vandeijck.com>
Link: https://github.com/openwrt/openwrt/pull/17981
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Use the "1/1" as a iteration count of hexdump expression instead of the
broken "1", to fix the issue that the invalid bootnum will be obtained.
Currently, the hexdump command always outputs "0" when the decimal format
and the iteration count "1" are specified[0]. This is unexpected
behaviour, but the cause is unknown and use this fix as a workaround.
[0]: https://github.com/openwrt/openwrt/issues/18808
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18827
Signed-off-by: Robert Marko <robimarko@gmail.com>
This is the same hardware as the Cudy WR2100 that's
had support for some time now, just without the WLAN
hardware.
This PR is mostly copied from the commit that added
support for the WR2100, here: 3501db9
Specifications:
SoC: MT7621
CPU: 880 MHz
Flash: 16 MiB
RAM: 128 MiB
Ethernet: 5x Gbit ports
Installation:
There are two known options:
The Luci-based UI.
Press and hold the reset button during power up.
The router will request 'recovery.bin' from a TFTP server at
192.168.1.88.
Both options require a signed firmware binary.
A signed firmware can be found in GitHub PR #18532.
R4 & R5 need to be shorted (0-100Ω) for the UART to work.
Link: https://github.com/openwrt/openwrt/pull/18532
Signed-off-by: David DeGraw <degraw@fastmail.com>
Add the necessary package dependencies as well as device-tree properties
to support the touch-inputs as well as missing LEDs on the Genexis Pulse
EX400 range extender.
Signed-off-by: David Bauer <mail@david-bauer.net>
Specifications:
SoC: Mediatek MT7621AT (880 MHz MIPS dual-core, quad-thread, CPU)
512 Megabyte DDR3 SDRAM
32 Megabyte NOR Flash
4 Gigabit RJ45 PoE ports
2 MT7615N wifi chips (2.4GHz and 5GHz)
2 USB ports (1xUSB2 and 1xUSB3 - GL3510 chip)
RJ45 RS232 port on front panel (Max3232 chip)
2x mPCIe 2.0 slots for 4G/5G cards
2x SIM slot
1x SDCard Slot
Power via DC12V
4x Cell Antennae
4x Wifi Antennae
MAC Address Locations:
Purpose Ex. Partition Offset
2.4 Ghz *:01 factory 0x4
5 GHz *:02 factory 0x8004
LAN *:03 factory 0xe000
WAN *:04 factory 0xe006
MAC address prefix E4:3A:65 is registered to MofiNetwork Inc
and used as the prefix for all MAC addresses.
Manual: https://mofinetwork.com/files/MoFi_Network_MOFI5500_5GXeLTE_EM7690_SPECS.pdf
WiFi chip specs: https://www.mediatek.com/products/broadband-wifi/mt7615
CPU chip specs: https://www.mediatek.com/products/home-networking/mt7621
Teardown Pictures: https://fccid.io/2AE6X-MOFI5500/Internal-Photos/Internal-Photos-5591739
Installation:
Update Mofi 5500 to at least stock firmware version 4.8.6. (Available on the Mofi website.)
Previous versions are untested in the upgrade process. Log into the LuCI web interface,
usually at 192.168.10.1 and visit the 'System->Backup/Flash Firmware' page.
Upload and flash the firmware as usual.
Note to Maintainers: Do not remove SUPPORTED_DEVICES from the Makefile!
The customized Mofi version of OpenWRT (stock firmware) expects to see mofi5500 as the device
name. The stock firmware does not allow for forcing an installation.
Without this line, users cannot upload the new firmware through the stock Mofi firmware.
This device uses cell modems that could use QMI or MBIM.
Add LuCI Modem Manager to allow people to use these. Also, if they have
two cell network cards, ethernet, USB, or other kinds of networks, they may wish
to use MWAN3 to allow failover amongst their networks.
Please compile it with mwan3 for multiple WAN connections.
Co-authored-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Signed-off-by: Rick Mac Gillis <noreply@rickmacgillis.com>
This commit adds support for Maginon MC-1200AC.
Hardware specifications:
SoC: MediaTek MT7621
Flash: 16 MB SPI Flash
RAM: 128 MB RAM
Ethernet:
2x 1G RJ45 ports
WLAN:
2.4GHz: MediaTek MT7603E
5GHz: MediaTek MT7613BE
LEDs: Red and blue status lights
Power: 12V DC
UART: 3.3V, 115200 baud, 8N1, like printed on silkscreen (GND,TX,RX,3.3V)
MAC addresses
-------------
+---------+-------------------+
| | MAC example |
+---------+-------------------+
| LAN | 80:3F:5D:xx:xx:72 |
| WAN | 80:3F:5D:xx:xx:73 |
| WLAN 2g | 80:3F:5D:xx:xx:74 |
| WLAN 5g | 80:3F:5D:xx:xx:75 |
+---------+-------------------+
Installation:
The firmware can be flashed via the U-Boot recovery web interface.
To access it, hold the reset button while powering on the device.
U-Boot recovery web interface is then avaiable at 192.168.10.1.
Alternatively, the image can be loaded using the U-Boot serial interface and TFTP.
Signed-off-by: Simon Etzlstorfer <simon@etzi.at>
Link: https://github.com/openwrt/openwrt/pull/17671
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The CONFIG_NET_SWITCHDEV option is needed by CONFIG_DSA and some other
options. It is boolean, we have to compile it into the kernel it self.
Activate it for all targets in the generic configuration, it is already
activated for most of them. This allows to install DSA drivers as a
module.
On the ramips/mt7620 target the kernel would grown by 4.5kB.
For some small targets which do not support a DSA switch by default the
option is deactivated.
Link: https://github.com/openwrt/openwrt/pull/17668
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The Zyxel LTE7490-M904 is an 802.3at PoE powered LTE outdoor (IP68) CPE
with integrated directional antennas.
Specifications:
- SoC: MediaTek MT7621AT
- RAM: 256 MB
- Flash: 128 MB MB NAND (MX30LF1G18AC)
- WiFi: MediaTek MT7603E 802.11b/g/n
- Switch: 1 LAN port (1 Gbps)
- LTE/3G/2G: Quectel EG18-EA LTE-A Cat. 18 connected by USB3 to SoC
- SIM: 1 micro-SIM slots under transparent cover
- Buttons: Reset, WLAN under same cover
- LEDs: Multicolour green/red/amber under same cover (visible)
- Power: 802.3at PoE via LAN port
The device is built as an outdoor ethernet to LTE bridge or router.
The wifi interface is intended for installation and/or temporary
management purposes only.
UART Serial:
57600N1, located on populated 5 pin header J5:
[o] GND
[ ] key - no pin
[o] RX
[o] TX
[o] 3.3V Vcc
Remove the SIM/button/LED cover and 12 screws holding the back plate
and antenna cover together. Be careful with the cables.
Installation from OEM web GUI:
- Log in as "admin" on OEM web GUI
- Upload OpenWrt initramfs-recovery.bin image on the
Maintenance -> Firmware page
- Wait for OpenWrt to boot and ssh to root@192.168.1.1
- Sysupgrade to the OpenWrt sysupgrade image and reboot
For more details about flashing see:
2449a63208 (ramips: mt7621: Add support for ZyXEL NR7101, 2021-04-19)
Main porting work done by Ernesto Castellotti <ernesto@castellotti.net>:
bf1c12f68b (ramips: add support for ZyXEL LTE7490-M904, 2023-12-20)
Signed-off-by: Eric Schäfer <eric@es86.de>
Link: https://github.com/openwrt/openwrt/pull/17485
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The code can be made more efficient by not extracting the sysupgrade.tar but
rather just querying for the filesize within the archive. Resorting to
manual update of UBI volume is extra work too, setting CI_KERNPART=rootfs_0
is enough.
Suggested-by: Andreas Gnau <andreas.gnau@iopsys.eu>
Signed-off-by: Mauri Sandberg <maukka@ext.kapsi.fi>
Link: https://github.com/openwrt/openwrt/pull/17806
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add support for Genexis Pulse EX400 / Inteno Pulse EX400. A branded
variant for the Finnish ISP DNA has already been added in fea2264d9f
(ramips: mt7621: Add DNA Valokuitu Plus EX400, 2023-07-31). This commit
adds support for the generic variants with Inteno and Genexis branding.
Inteno changed its name to Genexis and both brandings exist.
In terms of electronics, there is no difference between the DNA-branded
version and other brandings. LED markings on the case are different,
though. While the DNA-version has a "software-update" LED, the other
versions have a WPS LED. To reduce user confusion, create a separate
image.
Add the different device-tree with the different LED and rename things
to work the same way for both variants.
Specifications:
- Device: Genexis Pulse EX400 / Inteno Pulse EX400
- SoC: MT7621A
- Flash: 256 MB NAND
- RAM: 256 MB
- Ethernet: Built-in, 2 x 1 GbE
- Wifi: MT7603 2.4 GHz 2x2 MIMO, MT7615 5 GHz 4x4 MU-MIMO
- USB: 1x 2.0
- LEDs (GPIO): green/red status, green WPS
- LEDs (SX9512, unsupported): Broadband, Wi-Fi 2.4G, Wi-Fi 5G
- Buttons (GPIO): Reset
- Buttons (SX9512, unsupported): Wi-Fi 2.4G, Wi-Fi 5G, WPS
MAC addresses:
- LAN: U-Boot 'ethaddr' (label)
- WAN: label + 1
- 2.4 GHz: label + 6
- 5 GHz: label + 7
Serial:
There is a black block connector next to the red ethernet connector. It
is accessible also through holes in the casing.
Pinout (TTL 3.3V)
+---+---+
|Tx |Rx |
+---+---+
|Vcc|Gnd|
+---+---+
Firmware:
The vendor firmware is a fork of OpenWrt (Reboot) with a kernel version
4.4.93. The flash is arranged as below and there is a dual boot
mechanism alternating between rootfs_0 and rootfs_1.
+-------+------+------+-----------+-----------+
| | env1 | env2 | rootfs_0 | rootfs_1 |
| +------+------+-----------+-----------+
| | UBI volumes |
+-------+-------------------------------------+
|U-Boot | UBI |
+-------+-------------------------------------+
|mtd0 | mtd1 |
+-------+-------------------------------------+
| NAND |
+---------------------------------------------+
In OpenWrt rootfs_0 will be used as a boot partition that will contain the
kernel and the dtb. The squashfs rootfs and overlay are standard OpenWrt
behaviour.
+-------+------+------+-----------+--------+------------+
| | env1 | env2 | rootfs_0 | rootfs | rootfs_data|
| +------+------+-----------+--------+------------+
| | UBI volumes |
+-------+-----------------------------------------------+
|U-Boot | UBI |
+-------+-----------------------------------------------+
|mtd0 | mtd1 |
+-------+-----------------------------------------------+
| NAND |
+-------------------------------------------------------+
U-boot:
With proper serial access, booting can be halted to U-boot by pressing
any key. TFTP and flash writes are available, but only the first one has
been tested.
NOTE: Recovery mode can be accessed by holding down the reset button while
powering on the device. The led 'Update' will show a solid green light
once ready. A web server will be running at 192.168.1.1:80 and it will
allow flashing a firmware package. You can cycle between rootfs_0 and
rootfs_1 by pressing the reset button once.
Root password:
With the vendor web UI create a backup of your settings and download the
archive to your computer. Within the archive in the file
/etc/shadow replace the password hash for root with that of a password you
know. Restore the configuration with the vendor web UI and you will have
changed the root password.
SSH access:
You might need to enable the SSH service for LAN interface as by default
it's enabled for WAN only.
Installing OpenWrt:
With the vendor web UI, or from the U-Boot recovery UI, install the
OpenWrt factory image. Alternatively, ssh to the device and use
sysupgrade -n from cli.
Finalize by installing the OpenWrt sysupgrade image to get a fully
functioning system.
Reverting to the vendor firmware:
Boot with OpenWrt initramfs image
- Remove volumes rootfs_0, rootfs and rootfs_data and create vendor
volumes.
ubirmvol /dev/ubi0 -n 2
ubirmvol /dev/ubi0 -n 3
ubirmvol /dev/ubi0 -n 4
ubimkvol /dev/ubi0 -N rootfs_0 -S 990
ubimkvol /dev/ubi0 -N rootfs_1 -S 990
Power off and enter to the U-boot recovery to install the vendor
firmware.
Signed-off-by: Andreas Gnau <andreas.gnau@iopsys.eu>
Link: https://github.com/openwrt/openwrt/pull/17551
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The M1300 v2 is similar to the WR1300 series from Cudy. Differences:
- Only 1 LAN port
- No USB
Specifications:
- MT7621
- MT7603E (2.4G b/g/n) and MT7613BE (5G ac/n) wifi
- 128 MB RAM
- 16 MB flash
MAC Addresses:
- There is one on the label, e.g. xx:xx:xx:xx:xx:1C
- LAN (bottom connector) is the same as the label, e.g. xx:xx:xx:xx:xx:1C
- WAN (top connector) is label +2, e.g. xx:xx:xx:xx:xx:1E
- WLAN (2.4G) is the same as the label, e.g. xx:xx:xx:xx:xx:1C
- WLAN (5G) is the same as WAN, e.g. xx:xx:xx:xx:xx:1E
UART:
- is available via the pin holes on the board
- From inner to outer pin: TX, RX, GND, VCC
- Do NOT connect VCC
- Settings: 3.3V, 115200, 8N1
GPIO:
- There are two LEDs: Red (GPIO 3) and White (GPIO 4)
- There are two buttons: Reset (GPIO 8) and WPS (GPIO 10)
Migration to OpenWrt:
- Download the migration image from the Cudy website (it should be available as soon as OpenWrt officially supports the device)
- The migration image is also available here until a image is provided by Cudy: https://github.com/RolandoMagico/openwrt-build/releases/tag/M1300_Build_20240222
- File: openwrt-ramips-mt7621-cudy_m1300-v2-squashfs-flash-signed.bin
- Connect computer to LAN (bottom connector) and flash the migration image via OEM web interface
- In the migration image, LAN and WAN are swapped. Computer must be connected to the other port after flashing
- OpenWrt is now accessible via 192.168.1.1
- After flashing an up to date OpenWrt image, LAN and WAN settings are again the same as in the OEM firmware
- So use the other connector again
Revert back to OEM firmware:
- Set up a TFTP server on IP 192.168.1.88 and connect to the LAN port (lower port)
- Provide the Cudy firmware as recovery.bin in the TFTP server
- Press the reset button while powering on the device
- Recovery process is started now
- When recovery process is done, OEM firmware is accessible via 192.168.10.1 again
General information:
- No possibility to load a initramfs image via U-Boot because there is no option to interrupt U-Boot
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18139
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The spaces in variables have been stripped since commit 551e04f3c9
("base-files: strip space and tab characters from ASCII mac address"),
resulting "Vfac_mac " matches nothing. Fix the issue by removing the
space at end.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Link: https://github.com/openwrt/openwrt/pull/18150
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specification:
SoC: MediaTek MT7621A
RAM: 128M DDR3, Winbond W631GG6MB-12 (DDR3-1600) or Winbond W631GG6MB-11
Flash: 128M, Macronix MX30LF1G18AC-TI (Dual Boot, Parallel-NAND)
Switch: MT7530, 5 ports 1Gbps
WiFi: MT7615DN, 2.4GHz 802.11n and 5GHz 802.11ac
USB: 2 ports USB 2.0
GPIO: 4 buttons (Wi-Fi, Reset, FN1, FN2), 4 LEDs (Power, Internet, FN, Wi-Fi), USB port power controls
LAN: RF-EEPROM + 0x04
WAN: RF-EEPROM + 0x28
2.4 GHz: RF-EEPROM + 0x04
5 GHz: 2.4GHz + 82:00:00:00:00:00
Disassembly:
There are 2 screws at the bottom. After removing the screws, pry the gray plastic part around (it is secured with latches) and remove it.
Serial Interface:
The serial interface can be connected to the 4 pin dots to the left of the radiator.
Pins (from LAN ports to LEDs):
3.3V (do not connect)
TX
RX
GND
Settings: 57600, 8N1
Flashing via OEM recovery software:
1. Download the OEM recovery software from the manufacturer's website
2. Download the firmware image (for OpenWRT it is *-squashfs-factory.bin), rename it to KN-1910_recovery.bin
3. Replace the file in the fw folder OEM recovery software with the file from step 2.
4. Run the OEM recovery software and follow the instructions.
Flashing via TFTP:
1. Connect your PC and router to port 1-4, configure PC interface using IP 192.168.1.2, mask 255.255.255.252
2. Serve the firmware image (for OpenWRT it is *-squashfs-factory.bin) renamed to KN-1910_recovery.bin via TFTP
3. Power up the router while pressing Reset button on the back
4. Release Restart button when Power LED starts blinking
To revert back to OEM firmware:
The return to the OEM firmware is carried out by using the methods described above with the help of the appropriate firmware image.
Keenetic's bootloader supports booting a LZMA compressed kernel but seems to fail if the uncompressed data is larger than a fixed buffer therefore it is safer to use a uimage-lzma-loader. When using OEM bootloader, the firmware image size cannot exceed the size of one OEM «Firmware_x» partition or Kernel + rootFS size.
Signed-off-by: Anton Yu. Ivanusev <ivanusevanton@yandex.ru>
Link: https://github.com/openwrt/openwrt/pull/17381
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specifications:
- Device: ASUS 4g-AX56
- SoC: MT7621AT
- Flash: 128MB
- RAM: 512MB
- Switch: 1 WAN, 4 LAN (10/100/1000 Mbps)
- WiFi: MT7905 2x2 2.4G + MT7975 2x2 5G
- LTE : Fibocom FG621-EA
- LEDs: 1x POWER (white, configurable)
1x 2.4G (white, not configurable)
1x 5G (white, not configurable)
1x WAN (white, not configurable)
1x 3G/4G (white, not configurable)
3x signal (white, not configurable)
Flash by U-Boot TFTP method:
- Configure your PC with IP 192.168.0.2
- Set up TFTP server and put the factory.bin image on your PC
- Connect serial port(rate:115200) and turn on AP, then interrupt "U-Boot Boot Menu" by hitting any key
Select "2. Upgrade firmware"
Press enter when show "Run firmware after upgrading? (Y/n):"
Select 0 for TFTP method
Input U-Boot's IP address: 192.168.0.1
Input TFTP server's IP address: 192.168.0.2
Input IP netmask: 255.255.255.0
Input file name: openwrt-ramips-mt7621-asus_4g-ax56-squashfs-factory.bin
- Restart AP aftre see the log "Firmware upgrade completed!"
Notice:
- LTE module is disable after flash openwrt image so you must active LTE by following two AT command
echo -e "AT+GTAUTOCONNECT=1\r\n" > /dev/ttyUSB0
echo -e "AT+GTRNDIS=1,1\r\n" > /dev/ttyUSB0
- After finish AT command once, you don't need to input command later even if reboot/restore default
Signed-off-by: Chuncheng Chen <ccchen1984@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16752
Signed-off-by: John Crispin <john@phrozen.org>
Edgerouter X currently has its eth1 port on the switch missing since there
is a naming conflict currently.
So, as the root cause is mixing kernel support for DSA interfaces having
predictable names set via "label" property vs others having it assigned
dynamically lets avoid the conflict by using our own custom property as
suggested upstream [1].
So, add support via "openwrt,netdev-name" property and use it on ERX.
Fixes: 2a25c6ace8 ("ramips: get rid of downstream network device label patch")
Fixes: #15643
Link: https://github.com/openwrt/openwrt/pull/17062
Signed-off-by: Robert Marko <robimarko@gmail.com>
Use compat version to indicate that the new layout for larger kernels
is in place. This handled by the patch to ubnt.sh to always select
the kernel1 slot for flashing and as active kernel slot.
Signed-off-by: Tim Lunn <tim@feathertop.org>
Tested-by: Mauri Sandberg <maukka@ext.kapsi.fi>
Link: https://github.com/openwrt/openwrt/pull/15194
Signed-off-by: Petr Štetiar <ynezz@true.cz>
The gpiolib has already introduced a general GPIO irqchip framework
to initialize the GPIO irqchip[1]. This patch will make use of it
to simplify the legacy Ralink GPIO driver codes. This patch also
includes some code readability improvements.
[1] 1425052097b5 ("gpio: add IRQ chip helpers in gpiolib")
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Link: https://github.com/openwrt/openwrt/pull/16764
Signed-off-by: Robert Marko <robimarko@gmail.com>
The Gemtek WVRTM-127ACN is an indoor dual band wifi router
with internal antennas and 3 Gigabit Ethernet ports.
The Gemtek WVRTM-130ACN is an indoor dual band wifi router
with external antennas and 5 Gigabit Ethernet ports.
Hardware of WVRTM-127ACN:
- SoC: Mediatek MT7621AT (880 MHz, dual core)
- RAM: 128 MB
- Storage: 128 MB NAND SLC flash
- Ethernet: 3x 10/100/1000 Mbps LAN1,LAN2 & WAN
- Wireless: 2.4GHz: Mediatek MT7603EN (802.11b/g/n)
- Wireless: 5GHz: Mediatek MT7612EN (802.11n/ac)
- LEDs: 11x
- Buttons: 2x WPS, reset
- USB: 1x 3.0
- Power: 56 VDC, 0.54 A, PoE+ IN (WAN)
- PoE: 1x PoE+ 802.3af/at (WAN)
- Uart: GND RX TX VCC - J2 (GND near WAN)
- Board silkscreen: "WVRTM-127ACN_V02" "19K-513-8500R" "RoHS" "1717"
Hardware of WVRTM-130ACN:
- SoC: Mediatek MT7621AT (880 MHz, dual core)
- RAM: 128 MB (Kioxia TC58BVG0S3HTA00)
- Storage: 128 MB NAND SLC (Winbond W971GG6SB-25)
- Ethernet: 5x 10/100/1000 Mbps LAN1,LAN2,LAN3,LAN4 & WAN
- Wireless: 2.4GHz and 5GHz Mediatek MT7615DN (802.11ac/b/g/n) (DBDC)
- LEDs: 10x
- Buttons: 3x Power, WPS, reset
- USB: 1x 3.0
- Power: 56 VDC, 0.54 A, PoE+ (WAN)
- PoE: 1x PoE+ 802.3af/at (WAN)
- Uart: GND RX TX VCC - J2 (GND near WAN)
- Board silkscreen: "WVRTM-130ACN_V01" "19K-515-4500R" "RoHS" "2112"
Enable access to uboot menu (needed in wvrtm-130acn):
- The access to uboot menu is blocked by `bootdelay = 0` set in ubootenv.
With stock firmware version 01.01.02.163 and previous, you can use CVE 2020-24365
command injection https://nvd.nist.gov/vuln/detail/CVE-2020-24365
python3 exploit.py -t 192.168.1.1 -c "fw_setenv bootdelay 3; fw_saveenv"
Backup the stock firmware:
- Connect via uart
- Connect via ethernet and assign your pc the address 192.168.15.x/24
- Power on the device; and start typing '4' to enter uboot menu
- Set factory mode and boot
MT7621 # setenv factory 2; saveenv
MT7621 # nand read 2800000 2000000 81000000; bootm
- Telnet and copy all mtd blocks
telnet 192.168.15.1
- Copy all mtd blocks and start webserver
for N in $(seq 0 6); do dd if=/dev/mtd$N of=/tmp/eeprom_mtd$N.bin; done
mount -o bind /tmp /www
lighttpd -f /etc/lighttpd.conf
- Backup stock rootfs_data (optional)
dd if=/dev/mtd7 of=/tmp/eeprom_mtd7.bin
dd if=/dev/mtd8 of=/tmp/eeprom_mtd8.bin
- Download to your pc from http://192.168.15.1/eeprom_mtd$N.bin
Installation:
- Connect via uart
- Connect via ethernet and assign your pc the address 10.10.10.3/24
- Start a tftp server and serve the image initramfs-kernel.bin
mkdir /tmp/ftpd;
cp initramfs-kernel.bin /tmp/ftpd/kernel.bin
dnsmasq --enable-tftp --tftp-root=/tmp/ftpd
- Power on the device; and start typing '4' to halt the bootloader
- Change the active mtd partition from mtd6 to mtd5 (needed by uboot)
MT7621 # setenv mtddevnum 5; saveenv
- Write the openwrt initramfs in ram via tftp and boot it
MT7621 # tftpboot 81000000 kernel.bin; bootm
- From the initramfs create the ubi device and install openwrt via sysupgrade
ubiformat /dev/mtd11 -y
sysupgrade -n -v /tmp/sysupgrade.bin
Recovery:
Restore the stock firmware from the backup of the mtd blocks
mtd write eeprom_mtd5.bin firmware
mtd write eeprom_mtd6.bin Kernel2
mtd write eeprom_mtd7.bin Storage1
mtd write eeprom_mtd8.bin Storage2
ubiformat /dev/mtd8 -y
reboot
Links to previous works on wvrtm-127acn:
https://github.com/digiampietro/hacking-gemtekhttps://forum.openwrt.org/t/add-support-for-gemtek-wvrtm-127acn-linkem-provider/168757
Signed-off-by: Samuele Longhi <agave@dracaena.it>
Link: https://github.com/openwrt/openwrt/pull/16685
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Currently eth1 (which is the first "lan" interface) doesn't work on this device.
During boot the following can be seen in logs:
```
[ 2.252804] mt7530-mdio mdio-bus:1f: MT7530 adapts as multi-chip module
[ 2.266060] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 19
[ 2.277889] mtk_soc_eth 1e100000.ethernet eth1: mediatek frame engine at 0xbe100000, irq 19
...
[ 2.355157] mt7530-mdio mdio-bus:1f: MT7530 adapts as multi-chip module
[ 2.390312] mt7530-mdio mdio-bus:1f: configuring for fixed/rgmii link mode
[ 2.398597] mt7530-mdio mdio-bus:1f: Link is Up - 1Gbps/Full - flow control rx/tx
[ 2.403872] mt7530-mdio mdio-bus:1f eth1 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7530 PHY] (irq=21)
[ 2.416988] mtk_soc_eth 1e100000.ethernet eth0: error -17 registering interface eth1
[ 2.426973] mt7530-mdio mdio-bus:1f eth2 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7530 PHY] (irq=22)
[ 2.440996] mt7530-mdio mdio-bus:1f eth3 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7530 PHY] (irq=23)
[ 2.454405] mt7530-mdio mdio-bus:1f eth4 (uninitialized): PHY [mt7530-0:04] driver [MediaTek MT7530 PHY] (irq=24)
[ 2.467198] mtk_soc_eth 1e100000.ethernet eth0: entered promiscuous mode
[ 2.474117] DSA: tree 0 setup
...
[ 6.820998] mtk_soc_eth 1e100000.ethernet dsa: renamed from eth0
[ 6.919904] mtk_soc_eth 1e100000.ethernet wan: renamed from eth1
```
So the problem seems to be the fact that built-in gmacs get default
names (eth0/eth1) and are renamed after switch ports are initialized. This means
that when switch port with name `eth1` is brought up this name is still used by
gmac1 causing switch port's init to fail.
This patch just renames the ports to avoid name collision.
Note: this will break existing configs for this device because it renames all
the ports. This should not be major problem because this device doesn't have a
proper OEM image and is only flashable with serial access, meaning there should
not be many users.
Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15865
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hardware Specification:
SoC: Mediatek MT7621DAT (MIPS1004Kc 880 MHz, dual core)
RAM: 128 MB
Storage: 128 MB NAND flash
Ethernet: 5x 10/100/1000 Mbps LAN1,LAN2,LAN3,LAN4 & WAN
Wireless: 2.4GHz: Mediatek MT7603EN up to 300Mbps (802.11b/g/n MIMO 2x2)
Wireless: 5GHz: Mediatek MT7615N up to 1733Mbps (802.11n/ac MU-MIMO 4x4)
LEDs: Power (white & amber), Internet (white & amber)
LEDs: 2.4G (White), 5Ghz (White)
Buttons: WPS, Reset
USB: Front V3.0 & Rear V2.0
MAC Table
Label xx:xx:xx:xx:xx:38
LAN xx:xx:xx:xx:xx:39
2.4Ghz xx:xx:xx:xx:xx:3A
5Ghz xx:xx:xx:xx:xx:3C
WAN xx:xx:xx:xx:xx:38
Flash Instructions:
D-Link normal OEM firmware update page
1. upload OpenWRT factory.bin like any D-Link upgrade image
D-Link Fail Safe GUI:
1. Push and hold reset button (on the bottom of the device) until power led starts flashing (about 10 secs or so) while plugging in the power cable.
2. Give it ~30 seconds, to boot the fail safe GUI
3. Connect your client computer to LAN1 of the device
4. Set your client IP address manually to 192.168.0.2 / 255.255.255.0
5. Call the fail safe page for the device at http://192.168.0.1/
6. Use the provided fail safe web GUI to upload the factory.bin to the device
Signed-off-by: Alan Luck <luckyhome2008@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16269
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SoC: MediaTek MT7621
Flash: 16MB (Macronix MX25L12805D)
RAM: 128MB
Serial: As marked on PCB, baudrate is 57600, DO NOT CONNECT 3.3V!!!
Ethernet: 4x 10/100/1000 Mbps (3x LAN + WAN)
WIFI0: MT7615 2.4GHz 802.11b/g/n
WIFI1: MT7615 5GHz 802.11ac
Antennas: 6x external (3 per radio), non-detachable
LEDs: Programmable power-LED (blue-colored)
Buttons: Reset
INSTALLATION:
Get rootshell using insructions from https://gist.github.com/ZIKH26/18693c67ee7d2f8d2c60231b19194c37
Download and flash image
On computer:
python -m http.server
On router:
cd /tmp
wget http://:8000/factory.bin
mtd -r write factory.bin firmware
Device should reboot at this point.
Reverting to stock:
Download archive with firmware from Ruijie's site and
get .bin file from it. Then write that binary to firmware
partition. After reboot, factory-reset the router using
reset button.
Signed-off-by: Yahor Leonenka <staryjakau@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16202
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
ELECOM WSC-X1800GS is a 2.4/5 GHz band 11ax (Wi-Fi 6) mesh extender,
based on MT7621A
Specification:
- SoC : MediaTek MT7621A
- RAM : DDR3 512 MiB (Nanya NT5CC256M16ER-EK)
- Flash : RAW-NAND 128 MiB (Winbond W29N01HVSINF)
- WLAN : 2.4/5 GHz 2T2R (MediaTek MT7915D + MT7975D)
- Ethernet : 2x 10/100/1000 Mbps
- switch : MediaTek MT7530 (SoC)
- LEDs/Keys (GPIO): 9x/2x
- UART : through-hole on PCB ("J4")
- arrangement : 3.3V, GND, TX, RX from tri-angle marking
- settings : 115200n8
- Power : 12 VDC, 1 A (Max. 10.5 W)
Flash instruction using initramfs-factory image
1. Boot WMC-X1800GST normally
2. Access to "http://192.168.2.1/" and open firmware update page
("ファームウェア更新")
3. Select the OpenWrt initramfs-factory image and click apply ("適用")
button
4. On initramfs image, download sysupgrade image to the device and
perform sysupgrade with that image
5. Wait ~120 seconds to complete flashing
Notes:
- The "firmware" partition on the stock image is only 0xF00000 (15 MiB)
and it's too small for the current OpenWrt firmware with UBI format.
So use the unused area at the end of NAND flash for rootfs (UBI).
MAC addresses:
LAN : 04:AB:18:xx:xx:6E (Factory, 0x3fff4 (hex))
2.4 GHz: 04:AB:18:xx:xx:6F (Factory, 0x3fffa (hex))
5 GHz : 04:AB:18:xx:xx:70 (Factory, 0x4 (hex))
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16384
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
ELECOM WMC-X1800GST is a 2.4/5 GHz band 11ax (Wi-Fi 6) mesh router,
based on MT7621A
Specification:
- SoC : MediaTek MT7621A
- RAM : DDR3 512 MiB (Nanya NT5CC256M16ER-EK)
- Flash : RAW-NAND 128 MiB (Winbond W29N01HVSINF)
- WLAN : 2.4/5 GHz 2T2R (MediaTek MT7915D + MT7975D)
- Ethernet : 3x 10/100/1000 Mbps
- switch : MediaTek MT7530 (SoC)
- LEDs/Keys (GPIO): 9x/5x
- UART : through-hole on PCB ("J4")
- arrangement : 3.3V, GND, TX, RX from tri-angle marking
- settings : 115200n8
- Power : 12 VDC, 1 A (Max. 11.5 W)
Flash instruction using initramfs-factory image
1. Boot WMC-X1800GST normally with "Router" mode
2. Access to "http://192.168.2.1/" and open firmware update page
("ファームウェア更新")
3. Select the OpenWrt initramfs-factory image and click apply ("適用")
button
4. On initramfs image, download sysupgrade image to the device and
perform sysupgrade with that image
5. Wait ~120 seconds to complete flashing
Notes:
- The "firmware" partition on the stock image is only 0xF00000 (15 MiB)
and it's too small for the current OpenWrt firmware with UBI format.
So use the unused area at the end of NAND flash for rootfs (UBI).
MAC addresses:
LAN : 04:AB:18:xx:xx:BF (Factory, 0x3fff4 (hex))
WAN : 04:AB:18:xx:xx:C0 (Factory, 0x3fffa (hex))
2.4 GHz: 04:AB:18:xx:xx:C1 (Factory, 0x4 (hex))
5 GHz : 04:AB:18:xx:xx:C2
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16384
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for netis N6 WiFi 6 router.
Specification
-------------
- SoC : MediaTek MT7621AT, MIPS, 880 MHz
- RAM : 256 MiB
- Flash : NAND 128 MiB (ESMT PSU1GA30DT)
- WLAN : MT7905DAN + MT7975DN
- 2.4 GHz : b/g/n/ax, 574 Mbps, MIMO 2x2
- 5 GHz : a/n/ac/ax, 1201 Mbps, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x5 (1x WAN, 4x LAN)
- USB : 1x 3.0
- UART : 3.3V, 115200n8
- Buttons : 1x Reset
1x WPS
- LEDs : 1x Power (green)
1x System (green)
1x WAN (green)
1x WiFi 2.4 GHz (green), controlled by phy
1x WiFi 5 GHz (green), controlled by phy
1x WPS (green)
1x USB (green)
5x ethernet leds (green), controlled by switch
- Power : 12 VDC, 1.5 A
Installation
------------
1. Update the router using stock firmware web interface and OpenWrt
factory.bin image.
Recovery and return to stock
----------------------------
1. Assign your PC a static IP 192.168.1.2 and connect to the router using
the ethernet cable;
2. Power off the router;
3. Press Reset button, power on the router and wait until ethernet led
start blinking;
4. Release the button;
5. Open http://192.168.1.1/ (N6 System Recovery Mode) in your browser;
6. Upload OpenWrt factory.bin (or stock firmware *.bin) image and proceed
with upgrade.
MAC addresses
-------------
+---------+-------------------+
| | MAC example |
+---------+-------------------+
| LAN | dc:xx:xx:49:xx:04 |
| WAN | dc:xx:xx:49:xx:05 |
| WLAN 2g | dc:xx:xx:19:xx:06 |
| WLAN 5g | dc:xx:xx:79:xx:06 |
+---------+-------------------+
The WLAN MAC prototype was found in 'Factory', 0x4
The LAN MAC was found in 'Factory', 0x7ef20
The WAN MAC was found in 'Factory', 0x7ef26
Known issue
-----------
2.4 GHz WLAN doesn't start with mt76 driver.
Probable reason:
Original Netis N6 EEPROM contains wrong MT_EE_WIFI_CONF value (0xd2).
Other routers with the same WLAN hardware (e.g., Routerich AX1800)
have MT_EE_WIFI_CONF = 0x92.
Workaround (already included in this commit):
Extract EEPROM to a file at the first time boot and change
MT_EE_WIFI_CONF (offset 0x190) value from 0xd2 to 0x92. See
/etc/hotplug.d/firmware/11-mt76-caldata for details.
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16322
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specifications:
- Device: DNA Valokuitu Plus EX400
- SoC: MT7621A
- Flash: 256MB NAND
- RAM: 256MB
- Ethernet: Built-in, 2 x 1GbE
- Wifi: MT7603 2.4 GHz, MT7615 5 GHz (4x internal antennas)
- USB: 1x 3.0
- LED: 1x green/red, 1x green
- Buttons: Reset
MAC addresses:
- LAN: u-boot 'ethaddr' (label)
- WAN: label + 1
- 2.4 GHz: label + 6
- 5 GHz: label + 7
Serial:
There is a black block connector next to the red ethernet connector. It
is accessible also through holes in the casing.
Pinout (TTL 3.3V)
+---+---+
|Tx |Rx |
+---+---+
|Vcc|Gnd|
+---+---+
Firmware:
The vendor firmware is a fork of OpenWrt (Reboot) with a kernel version
4.4.93. The flash is arranged as below and there is a dual boot
mechanism alternating between rootfs_0 and rootfs_1.
+-------+------+------+-----------+-----------+
| | env1 | env2 | rootfs_0 | rootfs_1 |
| +------+------+-----------+-----------+
| | UBI volumes |
+-------+-------------------------------------+
|U-Boot | UBI |
+-------+-------------------------------------+
|mtd0 | mtd1 |
+-------+-------------------------------------+
| NAND |
+---------------------------------------------+
In OpenWrt rootfs_0 will be used as a boot partition that will contain the
kernel and the dtb. The squashfs rootfs and overlay are standard OpenWrt
behaviour.
+-------+------+------+-----------+--------+------------+
| | env1 | env2 | rootfs_0 | rootfs | rootfs_data|
| +------+------+-----------+--------+------------+
| | UBI volumes |
+-------+-----------------------------------------------+
|U-Boot | UBI |
+-------+-----------------------------------------------+
|mtd0 | mtd1 |
+-------+-----------------------------------------------+
| NAND |
+-------------------------------------------------------+
U-boot:
With proper serial access booting can be halted to U-boot by pressing any
key. TFTP and flash writes are available, but only the first one has been
tested.
NOTE: Recovery mode can be accessed by holding down the reset button while
powering on the device. The led 'Update' will show a solid green light
once ready. A web server will be running at 192.168.1.1:80 and it will
allow flashing a firmware package. You can cycle between rootfs_0 and
rootfs_1 by pressing the reset button once.
Root password:
With the vendor web UI create a backup of your settings and download the
archive to your computer. Within the archive in the file
/etc/shadow replace the password hash for root with that of a password you
know. Restore the configuration with the vendor web UI and you will have
changed the root password.
SSH access:
You might need to enable the SSH service for LAN interface as by default
it's enabled for WAN only.
Installing OpenWrt:
With the vendor web UI install the OpenWrt factory image. Alternatively,
ssh to the device and use sysupgrade -n from cli.
Finalize by installing the OpenWrt sysupgrade image to get a fully
functioning system.
Reverting to the vendor firmware:
Boot with OpenWrt initramfs image
- Remove volumes rootfs_0, rootfs and rootfs_data and create vendor
volumes.
ubirmvol /dev/ubi0 -n 2
ubirmvol /dev/ubi0 -n 3
ubirmvol /dev/ubi0 -n 4
ubimkvol /dev/ubi0 -N rootfs_0 -S 990
ubimkvol /dev/ubi0 -N rootfs_1 -S 990
Power off and enter to the U-boot recovery to install the vendor
firmware.
Known issues:
- MACs for wifi are stored in currently unknown place but it seems
to persist over power-off. They might be stored on the chip.
Signed-off-by: Mauri Sandberg <maukka@ext.kapsi.fi>
[rmilecki: try NVMEM for MACs]
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
From the kernel log, we are using PCIe port 1 and 2.
dmesg:
```
[ 0.963526] mt7621-pci 1e140000.pcie: pcie0 no card, disable it (RST & CLK)
[ 0.970432] mt7621-pci 1e140000.pcie: PCIE1 enabled
[ 0.975312] mt7621-pci 1e140000.pcie: PCIE2 enabled
[ 1.071442] pci 0000:01:00.0: [14c3:7662] type 00 class 0x028000
[ 1.130382] pci 0000:02:00.0: [14c3:7603] type 00 class 0x028000
```
Fixes: https://github.com/openwrt/openwrt/issues/16000
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Link: https://github.com/openwrt/openwrt/pull/16009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for a dual-band AX1800 wall plug manufactured
by Shenzhen Century Xinyang Tech Co., Ltd.
CPU: Mediatek MT7621A (2 cores, 4 threads)
RAM: 256i MiB DDR3 (Samsung K4B2G1646F-BCNB)
ROM: 16 MiB SPI NOR (Winbond W25Q128JVPQ)
Wired: one gigabit RJ45 port (with green/yellow non-GPIO LEDs)
WiFi: Mediatek MT7905DAN + MT7975DN (DBDC 2x 2T2R)
Ant.: four 2 dBi external antennas (two 2.4GHz, two 5 GHz)
GPIO: tri-color status LED (GPIO 13, 14, 16);
reset button (GPIO 18)
Power: 12V 2-pin JST-XH on main PCB
110/220V AC to 12V1A DC on auxiliary PCB
UART: 115200 8n1, SMD pads available on the PCB as J4
pinout is [3v3] (Rx) (Tx) (Gnd)
MAC: 1C:BF:CE:xx:xx:xx (2.4 GHz, label)
1C:BF:CE:xx:xx:xx + 1 (ethernet [1])
1C:BF:CE:xx:xx:xx + 2 (5 GHz)
Original firmware is LEDE Reboot 17.01-SNAPSHOT (kernel 4.4.198)
with a few custom packages and a non-LuCI web interface.
Telnet and SSH are enabled, requiring an unknown root password [2].
Root password is also needed to access the router via UART console,
but passwordless telnet can be enabled via a trivial web exploit [3]
and then the root password can be removed by editing `/etc/shadow`.
Installation: First upload `sysupgrade` binary via web interface at
`http://192.168.188.1/settings.shtml` and wait until getting back to
the home screen (select network to extend). The installation fails
since the original firmware uses `swconfig` and recent versions of
OpenWrt use DSA. However, the sysupgrade file is uploaded correctly
and stored at `/tmp/upgrade.bin`, so it can be written to flash via
the web exploit [4] (both `mtd -r write` and `sysupgrade -Fn` work
fine). Passwordless telnet/ssh is not needed for installation.
Alternatively, use u-boot menu to load image via TFTP.
Notes:
- Device model in LEDE is "MediaTek MT7621 RFB (802.11ax,SNOR)".
- It is sold under several names, among them are Wodesys WD-R1802U,
Fenvi F-AX1802U, and EDUP EP-2971; the Wodesys brand was selected
since it is referenced in `/etc/banner` and `/etc/hosts`, and the
PCB is marked "WD518A V1.0".
- Instead of a standard ethernet transformer, the PCB has a few tiny
SMD coils.
[1] Original firmware sets ethernet MAC to 1C:BF:CE:E7:62:1D based on
offset `0x3fff4` in the Factory partition; since this is the same
MAC for all units, whereas WiFi MACs stored at offsets 0x6 and 0xc
are unique, it was decided to use <label MAC + 1> for ethernet.
[2] root:$1$7rmMiPJj$91iv9LWhfkZE/t7aCBdo.0:18388:0:99999:7:::
[3] curl -X POST http://192.168.188.1/cgi-bin/adm.cgi \
-d page=Lang -d langType="en;killall telnetd;telnetd -l /bin/sh"
[4] curl -X POST http://192.168.188.1/cgi-bin/adm.cgi \
-d page=Lang -d langType="en;mtd -r write /tmp/upgrade.bin firmware"
Signed-off-by: Rani Hod <rani.hod@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15777
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
